CVE-2023-24537

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Go standard library	go/scanner	< 1.19.8; >= 1.20.0-0, < 1.20.3

References

https://go.dev/cl/482078Issue Tracking, Patch
https://go.dev/issue/59180Issue Tracking, Patch
https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8Mailing List, Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1702Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://go.dev/cl/482078Issue Tracking, Patch
https://go.dev/issue/59180Issue Tracking, Patch
https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8Mailing List, Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1702Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20241129-0004/

Timeline

Published: Apr 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated CVE-2023-24547.2schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke CVE-2023-245409.8Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the ch CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user t CVE-2023-245448.1Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.CVE-2023-245457.5On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service att CVE-2023-245468.1On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicio CVE-2023-245476.5On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be CVE-2023-245486.5On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in CVE-2023-245497.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The CVE-2023-24555.4Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases wh